In order to delegate the right to unlock locked user accounts to a user or group in Active Directory, you first need to make the right visible in Active Directory Users and Computers (ADUC).
The %windir%\System32\dssec.dat file contains all the rights attributes that can be exposed in ADUC. These rights attributes are grouped under headings surrounded by square brackets, such as [user] or [computer]. Each attribute is assigned a value (filter) as follows:
0 - Read and Write is exposed
1 - Write is exposed
2 - Read is exposed
7 - Hide the attribute
To modify the filter, open dssec.dat in Notepad. Find the lockoutTime attribute under the [user] heading. Be careful to select the [user] heading, as there's another lockoutTime attribute under [computer]. Change the value of the filter from 7 to 0 (lockoutTime=0) and save the changes.
To delegate the right right to unlock user accounts in ADUC:
- Right-click the OU or domain in Active Directory Users and Computers and select Delegate Control from the context menu
- Click Next on the Welcome dialog
- Click Add to select the user or group and click OK
- Click Next
- Select Create a custom task to delegate and click Next
- Select Only the following objects in the folder. In the list, check User objects and click Next
- Clear the General checkbox and check the Property-specific box
- Check both the Read lockoutTime and Write lockoutTime boxes and press Next
- Click Finish
Note: You only need to edit the dssec.dat file on the computer where you are performing the delegation. You do not need to modify it from any other machine, including the one where the user administration will occur.
Here's a tip on how to get the Num Lock key to stay on (or off) every time a user logs on.
